CVE-2026-22778 PIL Heap Address Leak in vLLM Multimodal Response
Detects responses from vLLM (or similar services) that leak a Python Imaging Library (PIL)/Pillow heap address through BytesIO exception text. This indicates Stage 1 of the CVE-2026-22778 ASLR bypass vulnerability, where memory addresses are exposed, which could be used by an attacker to bypass Address Space Layout Randomization (ASLR). The rule looks for specific error messages containing '_io.BytesIO object at 0x' followed by a hexadecimal address.
Microsoft Sentinel (KQL)
